The Banhammer plugin stores a site‑wide secret key that is deterministically derived from a constant character set using md5() and base64_encode(). Because the key is predictable, unauthenticated users can append a GET parameter named banhammer-process_{SECRET} to any URL to cause Banhammer to abort its logging and blocking for that request. This allows attackers to avoid being logged or blocked by the plugin, effectively disabling its protection controls. The weakness is identified as CWE‑330, a use of insufficiently random values.

WordPress sites running the Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin from specialk, versions 3.4.8 and earlier.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is under 1%, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely without authentication by crafting a GET request that contains the predictable secret key; no elevated privileges or compromise of the WordPress core is required.